A museums-and-culture department CE begins advertising a recursive default into the VRF and black-holes civic traffic. What PE-CE hygiene best stops that behavior?
Select an answer to reveal the explanation.
Short Explanation
A recursive default from a CE is a trapdoor under the VRF — traffic falls in and disappears. Filter on the PE inbound from that CE so junk defaults never land. Killing LSPs or juggling OSPF network types misses the actual hygiene point: do not accept bad routes from the CE.
Full Explanation
PE-CE routing hygiene includes inbound prefix filtering so a museums-and-culture CE cannot inject a recursive default or other damaging routes into the VRF. Applying inbound filters or well-known discard community policies on the PE rejects unwanted defaults at the attachment point and protects civic forwarding without dismantling underlay LSPs.
Deleting the transport LSP to that PE so the default cannot be label-switched is a blunt underlay outage, not hygiene. Forcing the CE into OSPF broadcast mode so defaults are “automatically ignored” does not replace prefix policy. Setting identical export RTs on every museum VRF so defaults are overwritten by full-mesh routes does not safely stop a recursive default injection.
Exam caveat: never accept unconstrained defaults from CEs into production VRFs—filter first, then consider maximum-prefix as defense in depth.
Operational check: apply inbound prefix lists rejecting defaults/summaries as policy requires, test that a malicious default from the CE is refused, and combine with maximum-prefix alarms on the museum PE. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.